Browse Source

[beeswax] Pass in keytab to beeswax server for it to auto renew ticket

* Use .equals() instead of `==' to compare strings
* Removed unused `superuser' option
bc Wong 13 years ago
parent
commit
10ae072

+ 10 - 19
apps/beeswax/java/src/main/java/com/cloudera/beeswax/Server.java

@@ -64,8 +64,6 @@ public class Server {
 
   private static int mport = -1;
   private static int bport = -1;
-  /** Superuser on the HDFS cluster.  We impersonate to create Hive's directories. */
-  private static String superUser = "hadoop";
   /** Host and port that desktop runs on */
   private static String dtHost = "";
   private static int dtPort = -1;
@@ -132,15 +130,10 @@ public class Server {
     dtPortOpt.setRequired(false);
     dtOptions.addOption(dtPortOpt);
 
-    Option superUserOpt = new Option("u", "superuser", true,
-                                    "Username of Hadoop superuser (default: hadoop)");
-    superUserOpt.setRequired(false);
-    options.addOption(superUserOpt);
-
     Option noDesktopOpt = new Option("n", "no-desktop", false, "no desktop used");
     dtOptions.addOption(noDesktopOpt);
 
-    Option kPrincipalOpt = new Option("c", "principalConf", true, "Pricipal configuration");
+    Option kPrincipalOpt = new Option("c", "principalConf", true, "Principal configuration");
     options.addOption(kPrincipalOpt);
 
     Option kTabOpt = new Option("k", "keytab", true, "keytab file");
@@ -158,26 +151,24 @@ public class Server {
     }
 
     for (Option opt : cmd.getOptions()) {
-      if (opt.getOpt() == "m") {
+      if (opt.getOpt().equals("m")) {
         mport = parsePort(opt);
-      } else if (opt.getOpt() == "b") {
+      } else if (opt.getOpt().equals("b")) {
         bport = parsePort(opt);
-      } else if (opt.getOpt() == "u") {
-        superUser = opt.getValue();
-      } else if (opt.getOpt() == "h") {
+      } else if (opt.getOpt().equals("h")) {
         dtHost = opt.getValue();
-      } else if (opt.getOpt() == "p") {
+      } else if (opt.getOpt().equals("p")) {
         dtPort = parsePort(opt);
-      } else if (opt.getOpt() == "s") {
+      } else if (opt.getOpt().equals("s")) {
         dtHttps = true;
-      } else if (opt.getOpt() == "l") {
+      } else if (opt.getOpt().equals("l")) {
         qlifetime = Long.valueOf(opt.getValue());
-      } else if (opt.getOpt() == "k") {
+      } else if (opt.getOpt().equals("k")) {
         keytabFile = opt.getValue();
         useKerberos = true;
-      } else if (opt.getOpt() == "c") {
+      } else if (opt.getOpt().equals("c")) {
         principalConf = opt.getValue();
-      } else if (opt.getOpt() == "r") {
+      } else if (opt.getOpt().equals("r")) {
         refreshInterval = Integer.valueOf(opt.getValue()) * 1000 * 60; // minutes
       }
 

+ 9 - 1
apps/beeswax/src/beeswax/db_utils.py

@@ -23,6 +23,9 @@ import logging
 import thrift
 import time
 
+import desktop.conf
+import hadoop.cluster
+
 from beeswax import conf
 from beeswax import models
 from beeswax import hive_site
@@ -30,7 +33,7 @@ from beeswax.models import QueryHistory
 from beeswaxd import BeeswaxService
 
 from django.utils.encoding import smart_str, force_unicode
-from desktop.lib import thrift_util, i18n
+from desktop.lib import thrift_util
 from hive_metastore import ThriftHiveMetastore
 from beeswaxd.ttypes import BeeswaxException, QueryHandle, QueryNotFoundException
 
@@ -202,10 +205,15 @@ def db_client():
       res = self._client.get_results_metadata(*args, **kwargs)
       return _decode_struct_attr(res, 'table_dir')
 
+  cluster_conf = hadoop.cluster.get_cluster_conf_for_job_submission()
+  use_sasl = cluster_conf is not None and cluster_conf.SECURITY_ENABLED.get()
+
   client = thrift_util.get_client(BeeswaxService.Client,
                                 conf.BEESWAX_SERVER_HOST.get(),
                                 conf.BEESWAX_SERVER_PORT.get(),
                                 service_name="Beeswax (Hive UI) Server",
+                                kerberos_principal="hue",
+                                use_sasl=use_sasl,
                                 timeout_seconds=conf.BEESWAX_SERVER_CONN_TIMEOUT.get())
   return UnicodeBeeswaxClient(client)
 

+ 10 - 0
apps/beeswax/src/beeswax/management/commands/beeswax_server.py

@@ -72,6 +72,16 @@ class Command(NoArgsCommand):
       str(beeswax.conf.BEESWAX_RUNNING_QUERY_LIFETIME.get()),
     ]
 
+    # Pass in keytab if security is turned on. Beeswax periodically renews
+    # the ticket.
+    if cluster_conf.SECURITY_ENABLED.get():
+      args += [
+        '--keytab',
+        desktop.conf.KERBEROS.HUE_KEYTAB.get(),
+        '--principalConf',
+        desktop.conf.KERBEROS.HUE_PRINCIPAL.get(),
+      ]
+
     # Running on HTTPS?
     if desktop.conf.is_https_enabled():
       args.append('--desktop-https')

+ 4 - 1
desktop/conf.dist/hue.ini

@@ -224,7 +224,7 @@
       # Defaults to $HADOOP_CONF_DIR or /etc/hadoop/conf
       ## hadoop_conf_dir=/etc/hadoop/conf
 
-  # Configuration for Yarn (MR2)
+  # Configuration for YARN (MR2)
   # ------------------------------------------------------------------------
   [[yarn_clusters]]
 
@@ -236,6 +236,9 @@
       # Whether to submit jobs to this cluster
       ## submit_to=False
 
+      # Change this if your YARN cluster is Kerberos-secured
+      ## security_enabled=false
+
       # Settings about this MR2 cluster. If you install MR2 in a
       # different location, you need to set the following.
 

+ 6 - 0
desktop/conf/pseudo-distributed.ini.tmpl

@@ -186,6 +186,8 @@
       # and explicitly set to the empty value.
       ## webhdfs_url=
 
+      ## security_enabled=false
+
       # Settings about this HDFS cluster. If you install HDFS in a
       # different location, you need to set the following.
 
@@ -212,6 +214,8 @@
       # Whether to submit jobs to this cluster
       ## submit_to=False
 
+      ## security_enabled=false
+
       # Settings about this MR1 cluster. If you install MR1 in a
       # different location, you need to set the following.
 
@@ -236,6 +240,8 @@
       # Whether to submit jobs to this cluster
       ## submit_to=False
 
+      ## security_enabled=false
+
       # Settings about this MR2 cluster. If you install MR2 in a
       # different location, you need to set the following.
 

+ 2 - 0
desktop/libs/hadoop/src/hadoop/conf.py

@@ -176,6 +176,8 @@ YARN_CLUSTERS = UnspecifiedConfigSection(
                   default=8032,
                   type=int,
                   help="Service port for the ResourceManager"),
+      SECURITY_ENABLED=Config("security_enabled", help="Is running with Kerberos authentication",
+                              default=False, type=coerce_bool),
       SUBMIT_TO=Config('submit_to', help="Whether Hue should use this cluster to run jobs",
                        default=False, type=coerce_bool),